Re: About libnetfilter_queue

Re: About libnetfilter_queue

[Jan Engelhardt]

bounce nf-dev

On Thursday 2009-06-18 16:46, Gérald Colangelo wrote:

>Hi guy,
>
>I wrote you today since i noticed you're contributing regulary to the
>netfilter-devel list ...
>Since the trafic is quiet huge, i unsubscribe, but i want to pass an
>information i discovered while coding ...
>If you init all the libnetfilter_queue stuff and then, setuid(!0), then you
>won't be able to send packet, the kernel drops it silently ...
>I've been looking for the solution for 5 days ! That's why i prefered telling
>you, and if you find this information useful, relay it to the list :)
>
>Regards,
>
>-- 
>Gérald Colangelo 
>binarym@psycho-hazard.net - http://www.yanluo.net
>
>Being a sysadmin means hours of hard labor every day.
>Being an abusive sysadmin means hours of fun.
>
>

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: About libnetfilter_queue

[Pablo Neira Ayuso]

Jan Engelhardt wrote:
> bounce nf-dev
> 
> On Thursday 2009-06-18 16:46, Gérald Colangelo wrote:
> 
>> Hi guy,
>>
>> I wrote you today since i noticed you're contributing regulary to the
>> netfilter-devel list ...
>> Since the trafic is quiet huge, i unsubscribe, but i want to pass an
>> information i discovered while coding ...
>> If you init all the libnetfilter_queue stuff and then, setuid(!0), then you
>> won't be able to send packet, the kernel drops it silently ...

You still have to keep CAP_NET_ADMIN to make it. And you should get
EPERM when sending packets.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: About libnetfilter_queue

[Gérald Colangelo]

On Fri, Jun 19, 2009 at 03:52:54PM +0200, Pablo Neira Ayuso wrote:
> Jan Engelhardt wrote:
> 
> You still have to keep CAP_NET_ADMIN to make it. And you should get
> EPERM when sending packets.

Ok, i didn't know for the CAP_NET_ADMIN.
But i didn't get EPERM, nfq_set_verdict just returned me a value more than
0... perhaps EPERM is stored in errno, but at least nfq_set_verdict() reports
success.

Regards,

-- 
Gérald Colangelo 
binarym@psycho-hazard.net - http://www.yanluo.net

Being a sysadmin means hours of hard labor every day.
Being an abusive sysadmin means hours of fun.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: About libnetfilter_queue

[Pablo Neira Ayuso]

Gérald Colangelo wrote:
> On Fri, Jun 19, 2009 at 03:52:54PM +0200, Pablo Neira Ayuso wrote:
>> Jan Engelhardt wrote:
>>
>> You still have to keep CAP_NET_ADMIN to make it. And you should get
>> EPERM when sending packets.
> 
> Ok, i didn't know for the CAP_NET_ADMIN.
> But i didn't get EPERM, nfq_set_verdict just returned me a value more than
> 0... perhaps EPERM is stored in errno, but at least nfq_set_verdict() reports
> success.

You're right. We're sending the netlink message to kernel-space without
the NLM_F_ACK flag set, that's why we don't get any error reporting
back. I'm going to look into this.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html